[Webkit-unassigned] [Bug 144666] New: WebBackForwardList::backForwardListState(filter) can set the currentIndex to a really large number

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=144666

            Bug ID: 144666
           Summary: WebBackForwardList::backForwardListState(filter) can
                    set the currentIndex to a really large number
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit2
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: adachan at apple.com

If the currentIndex is 0 and the first item gets filtered out, we'll end up decrementing currentIndex (which is bad as it's unsigned).

See the code here:

    for (size_t i = 0; i < m_entries.size(); ++i) {
        auto& entry = *m_entries[i];

        if (filter && !filter(entry)) {
            if (backForwardListState.currentIndex && i <= backForwardListState.currentIndex.value())
                --backForwardListState.currentIndex.value();

            continue;
        }

        backForwardListState.items.append(entry.itemState());
    }

Seems like we should check whether the currentIndex > 0 before decrementing it. And if the list items end up being all filtered out, then the currentIndex should be set to the "uninitialized" value.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150506/aa8d448d/attachment.html>